Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 252
  • Last Modified:

Configuration Problems with a Cisco Site-to-Site VPN

I'm trying to add a site-to-site VPN connection to a Cisco 1711 that already has a working EZvpn setup.  I have been over this to the point that I'm just not seeing what I'm missing.  It is failing to establish IKE.  Any pointers as to what I'm missing would be most appreciated.  This is the Hub router config.
1 Solution
You named you static map "dynmap" and gave the reference to your dynamic-map (which you also called dynmap) as first priority whatever static you enter after here dosnt matter as they will match your dynamic map and as the site-to-site dosnt have any groupname to match a ISAKMP will not be established.

crypto map dynmap (Static map name) 1 ipsec-isakmp dynamic dynmap (dynamic map name)

So change your dynamic map to a higher prio like 65000 and add you static as a lower number. that should get you to first base :P

Example of static map with dynamic map:
crypto dynamic-map DYN-VPN 1
 set transform-set groupname1
 set isakmp-profile groupname1-profile
crypto dynamic-map DYN-VPN 2
 set transform-set groupname2
 set isakmp-profile groupname2-profile
crypto map VPN 1 ipsec-isakmp
 set peer x.x.x.x
 set transform-set CUST1-L2L
 set pfs group2
 set isakmp-profile CUST1-L2L
 match address CUST1-L2L
crypto map VPN 2 ipsec-isakmp
 set peer y.y.y.y
 set transform-set CUST2-L2L
 set pfs group2
 set isakmp-profile CUST2-L2L
 match address CUST2-L2L
crypto map VPN 65000 ipsec-isakmp dynamic DYN-VPN

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now